Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,748)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-14415 1Veritas 1Resiliency Platform Jun 17, 2026 Jul 29, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, relat...Show more An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that an attacker has access to.Show less
CVE-2019-11199 1Dolibarr 1Dolibarr Erp/crm Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link...Show more Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.Show less
CVE-2015-6960 1Edx 1Edx Platform Nov 21, 2024 Jul 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 edx-platform before 2015-09-17 allows XSS via a team name.
CVE-2015-6253 1Edx 1Edx Platform Nov 21, 2024 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
CVE-2019-1020008 1Stacktable.js Project 1Stacktable.js Jun 17, 2026 Jul 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 stacktable.js before 1.0.4 allows XSS.
CVE-2019-1020007 1Owasp 1Dependency Track Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dependency-Track before 3.5.1 allows XSS.
CVE-2019-1020005 1Inveniosoftware 1Invenio Communities Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 invenio-communities before 1.0.0a20 allows XSS.
CVE-2019-1020003 1Inveniosoftware 1Invenio Records Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 invenio-records before 1.2.2 allows XSS.
CVE-2019-1105 1Microsoft 1Outlook Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email...Show more A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages.Show less
CVE-2019-1020019 1Inveniosoftware 1Invenio Previewer Jun 17, 2026 Jul 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 invenio-previewer before 1.0.0a12 allows XSS.
CVE-2019-1020010 1Misskey 1Misskey Jun 17, 2026 Jul 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Misskey before 10.102.4 allows hijacking a user's token.
CVE-2019-14364 1Icegram 1Email Subscribers & Newsletters Jun 17, 2026 Jul 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin...Show more An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.Show less
CVE-2019-14350 1Espocrm 1Espocrm Jun 17, 2026 Jul 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle kn...Show more EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation.Show less
CVE-2019-14349 1Espocrm 1Espocrm Jun 17, 2026 Jul 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that...Show more EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user opens a page of any profile with this.Show less
CVE-2019-14331 1Espocrm 1Espocrm Jun 17, 2026 Jul 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
CVE-2019-14330 1Espocrm 1Espocrm Jun 17, 2026 Jul 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
CVE-2019-14329 1Espocrm 1Espocrm Jun 17, 2026 Jul 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can modify the parameter name to contain JavaScript code.
CVE-2019-14315 1Sunhater 1Kcfinder Jun 17, 2026 Jul 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter.
CVE-2019-14298 1Veeam 1One Reporter Jun 17, 2026 Jul 27, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.
CVE-2019-14297 1Veeam 1One Reporter Jun 17, 2026 Jul 27, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.

Previous 1...186818691870...2438 Next